Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ce52be438bc12fbf4f796bd5856ddd1b496b6e35abeabd075d0ade053d3425a6

  • Size

    762KB

  • Sample

    230212-w1dw2sfa8t

  • MD5

    8206150ffac4406dfbf7202b6d90590d

  • SHA1

    b73b791ed6a213d2a4d11358bcf05f5c99b97a99

  • SHA256

    ce52be438bc12fbf4f796bd5856ddd1b496b6e35abeabd075d0ade053d3425a6

  • SHA512

    37c085f2c66bbab227feb8f8a7b74839ef932a6ce8992f06efdd213e3ff853e71f42e2fa1bc438d51395ee12e2e26fc9d535d43eb4c859ce149418bf208bb8bd

  • SSDEEP

    12288:1Mrfy90SCTeY/rF7tF9QoXtWg7Sk45TNU2jvsjer/7XE21+TEJ8ekoRxCD1ItRbf:mytlerFr97dVcjvsjeLbGE69owuFpsqX

Malware Config

Extracted

Family

redline

Botnet

cr2

C2

176.113.115.17:4132

Attributes
  • auth_value

    4bf573d6f5ab16f3b5e36da6855dc128

Extracted

Family

redline

Botnet

dunm

C2

193.233.20.12:4132

Attributes
  • auth_value

    352959e3707029296ec94306d74e2334

Targets

    • Target

      ce52be438bc12fbf4f796bd5856ddd1b496b6e35abeabd075d0ade053d3425a6

    • Size

      762KB

    • MD5

      8206150ffac4406dfbf7202b6d90590d

    • SHA1

      b73b791ed6a213d2a4d11358bcf05f5c99b97a99

    • SHA256

      ce52be438bc12fbf4f796bd5856ddd1b496b6e35abeabd075d0ade053d3425a6

    • SHA512

      37c085f2c66bbab227feb8f8a7b74839ef932a6ce8992f06efdd213e3ff853e71f42e2fa1bc438d51395ee12e2e26fc9d535d43eb4c859ce149418bf208bb8bd

    • SSDEEP

      12288:1Mrfy90SCTeY/rF7tF9QoXtWg7Sk45TNU2jvsjer/7XE21+TEJ8ekoRxCD1ItRbf:mytlerFr97dVcjvsjeLbGE69owuFpsqX

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks